Summary
Some high-ranking online tools for editing or "cleaning" HTML seem to secretly insert links into their output in order to push themselves and their related sites in the search engine rankings. This scam is very successful and seems to have gone unnoticed until now.
The tools that seem to do this are all created by the same people:
- html-cleaner.com
- html-online.com/editor/
- html5-editor.net
- htmlg.com
- … other
The victims of this were the sites BoingBoing, the official football association of Germany and Kaspersky. It's funny that Kaspersky's "hacked" article is devoted to "protection from hackers".
Detection of suspicious
So, here is a detailed account of how I made this discovery, along with the evidence I found.
It all started with the puzzle of the product I am creating. The product is an online scoreboard , and despite having (what I think) a solid SEO strategy, I haven't managed to land the coveted number one spot on the search engine results page. For the past 12 months I've always been ahead of me by a member called "Scorecounter".
Now, due to the nature of my product, people are sharing links to it and embedding it on their websites, which means that over time I am building up a lot of inbound links. Over time, my SEO ranking will become unbeatable. The competitor does not have such a noticeable virality as I do, but I always have it better than SEO. What trick are they using?
So last night I drank 2 glasses of red wine and instead of deleting the production database (like last time) I decided to sort it out. I paid for an Ahrefs subscription and took a look at Scorecounter's "backlink profile". Here's what I found:
Scorecounter has 3600 inbound links that it has amassed in a very short time. Impressive!
Then I started browsing pages containing links, and this is where I got my suspicions.
For example, I saw a blog post from the German Football Association containing a link to Scorecounter. The word that was referenced was "score", but the reference here made absolutely no sense in the context of the article. What's happened?
Here are some more examples of links I found on random domains (you need to search on the "score" page).
There are just a bunch of such pages out there (check it out for yourself if you have an Ahrefs account).
So I wrote several emails to 1-2 of these sites and asked them why they have these links on their pages. Did all of these sites sell links?
I received the following response from an online news portal:
, . , .
HTML (html-online.com/editor/) , , , , HTML .
, , , , . , , , , . -- .
Aha! Here's the secret: the makers of Scorecounter also made an online HTML editor that inserts links for specific keywords. The beauty of this scam is that by injecting the links into their own HTML editor, they created a wonderful positive feedback loop: the higher it goes up in the search rankings, the more people use it and the more secret links they can enter.
Now, if you're feeling very generous, you might argue that the editor is a freemium tool, and that added links is how you pay for the free version. Well, I don't feel generous, I suspect Google does too.
In addition to improving the HTML editor itself and the Scorecounter, I found a third product that got everyone's attention:
Rubik's Cube
Ruwix.com is created by the same people and is dedicated to the famous puzzle game. Again, it is very easy to find a large number of Ruwix.com backlinks on random sites with Ahrefs.com. Each of these articles represents a discrepancy in the text they are crammed into, which shows me that the authors of these articles had no idea what was going on. Take a look (on the page you need to search for "Rubiks"):
UPD: Kaspersky removed the link, but I have a screenshot:
To find out how common this injection is, try searching Google: "Learn how to solve a Rubix Cube with the beginner method" . Over 600 visits to a wide variety of sites. Surprisingly, the link even made its way into the research article (it's on page 24, at the bottom of the Links section)!
A whole network of tools
After digging through the backlinks, I discovered that there is a whole network of tools that are all part of a single operation. They all have the same backlink profiles. They include:
- htmltidy.net
- html-css-js.com
- divtable.com
- html-cleaner.com
- html5-editor.net
- htmlg.com
Doing a Google search for "HTML Editor" reveals that these tools are in the top three positions in search results. This demonstrates how successful this scam has been.
The embedding of links is mentioned in the "Terms of Service" of these tools
It is true that the “terms of use” for at least one tool include the following:
We serve ads and can randomly link to the end of the cleaned documents.
I sincerely doubt this disclaimer is enough to prevent Google retribution. We'll find out soon.